Message-ID: <2024040335-CVE-2024-26685-e15e@gregkh>
Date: Wed,  3 Apr 2024 16:55:36 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-26685: nilfs2: fix potential bug in end_buffer_async_write

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix potential bug in end_buffer_async_write

According to a syzbot report, end_buffer_async_write(), which handles the
completion of block device writes, may detect abnormal condition of the
buffer async_write flag and cause a BUG_ON failure when using nilfs2.

Nilfs2 itself does not use end_buffer_async_write().  But, the async_write
flag is now used as a marker by commit 7f42ec394156 ("nilfs2: fix issue
with race condition of competition between segments for dirty blocks") as
a means of resolving double list insertion of dirty blocks in
nilfs_lookup_dirty_data_buffers() and nilfs_lookup_node_buffers() and the
resulting crash.

This modification is safe as long as it is used for file data and b-tree
node blocks where the page caches are independent.  However, it was
irrelevant and redundant to also introduce async_write for segment summary
and super root blocks that share buffers with the backing device.  This
led to the possibility that the BUG_ON check in end_buffer_async_write
would fail as described above, if independent writebacks of the backing
device occurred in parallel.

The use of async_write for segment summary buffers has already been
removed in a previous change.

Fix this issue by removing the manipulation of the async_write flag for
the remaining super root block buffer.

The Linux kernel CVE team has assigned CVE-2024-26685 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 4.19.307 with commit c4a09fdac625
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 5.4.269 with commit d31c8721e816
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 5.10.210 with commit f3e4963566f5
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 5.15.149 with commit 8fa90634ec3e
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.1.79 with commit 6589f0f72f8e
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.6.18 with commit 2c3bdba00283
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.7.6 with commit 626daab3811b
	Issue introduced in 3.12 with commit 7f42ec394156 and fixed in 6.8 with commit 5bc09b397cbf
	Issue introduced in 3.2.52 with commit ccebcc74c81d
	Issue introduced in 3.4.83 with commit 831c87640d23
	Issue introduced in 3.10.16 with commit d8974c7fe717
	Issue introduced in 3.11.5 with commit 8f67918af09f

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26685
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/nilfs2/segment.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c4a09fdac625e64abe478dcf88bfa20406616928
	https://git.kernel.org/stable/c/d31c8721e816eff5ca6573cc487754f357c093cd
	https://git.kernel.org/stable/c/f3e4963566f58726d3265a727116a42b591f6596
	https://git.kernel.org/stable/c/8fa90634ec3e9cc50f42dd605eec60f2d146ced8
	https://git.kernel.org/stable/c/6589f0f72f8edd1fa11adce4eedbd3615f2e78ab
	https://git.kernel.org/stable/c/2c3bdba00283a6c7a5b19481a59a730f46063803
	https://git.kernel.org/stable/c/626daab3811b772086aef1bf8eed3ffe6f523eff
	https://git.kernel.org/stable/c/5bc09b397cbf1221f8a8aacb1152650c9195b02b

Powered by blists - more mailing lists